Cloudanix VulnDB

GHSA-xp4f-g2cm-rhg7

Medium · 5.3

PocketMine-MP has LogDoS by many junk properties in client data JWT in LoginPacket

CVSS

5.3

EPSS

—

Published

Apr 15, 2026

CISA due date

—

The record

Attackers can fill the body of the clientData JWT in LoginPacket with lots of junk properties, causing the server to flood warning messages, as well as wasting CPU time. This happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties instead of rejecting them outright. While this behaviour increases flexibility for random changes introduced by Microsoft, it also creates vulnerabilities if not handled carefully. This vulnerability affects PocketMine-MP servers exposed to a public network where unknown actors may have access.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities